The Web Application Hacker’s Handbook Discovering and Exploiting Security Flaws

the source. It should be obvious which methods can be invoked from

JavaScript, and what their signatures are, enabling you to test the behav-

ior of the methods by passing in various inputs.

■

If class, method, and member variable names have been replaced with

meaningless expressions (but not Java keywords), then you can use the

refactoring functionality built into many IDEs to assist you in understand-

ing the code. By studying how items are used, you can start to assign

them meaningful names. If you use the “rename” tool within the IDE, it

will do a lot of work for you, tracing the use of the item throughout the

codebase and renaming it everywhere.

■

You can actually undo a lot of obfuscation by running the obfuscated

bytecode through an obfuscator a second time and choosing suitable